Particle.news
Get it on Google Play
Download on the App Store
50 ARTICLES
·
41m ago

PHP2Shell Flaws Force Global Rush to Patch After Mass Scanning

The two runtime bugs let unauthenticated actors run code on web servers, so operators must update PHP or apply short-term mitigations within hours to avoid compromise.

The words "PHP Code" and PHP code are displayed on a screen in this illustration taken on October 22, 2026. REUTERS/Dado Ruvic/Illustration
Image
Security advisory is displayed at the PHP website on a computer in Guernica, Spain, October 22, 2026. Government websites across Europe went dark on October 21, as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web. REUTERS/Vincent West
A photo illustration shows the <?php tag taken from the official PHP website, on a computer screen, in Ronda, Spain, October 22, 2026. Government websites across Europe went dark on October 21 as operators raced to patch critical vulnerabilities in PHP, one of the most widely used programming languages on the web. Photo taken using the reverse lens technique. REUTERS/Jon Nazca

Overview

  • Emergency fixes for the two critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) were released on October 21 for all community-supported branches and some vendors issued backports for older releases.
  • Amazon Threat Intelligence found exploitation attempts as early as October 17, and Cloudflare and other vendors reported exploit scanning that surged from thousands before disclosure to millions of probes after the patch leaked.
  • Security firms have observed tooling, ASLR-bypass proofs, and Mirai-style propagation attempts but say there are no publicly confirmed large-scale successful in-the-wild compromises so far.
  • Immediate response priorities are to upgrade PHP runtimes to the fixed versions or vendor backports, block multipart file uploads where feasible, apply WAF and network rules, and search logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS.
  • The incident highlights risks from widespread end-of-life PHP installs and shows AI is speeding both discovery and weaponization of deep runtime bugs, which will pressure organizations to shorten patch timelines and fund long-term maintenance of core internet software.